Who this is for: people who booked through the app or web booking of @link (at-link), a booking and reception system used by clinics and hospitals in Japan; people who have been to a clinic that uses at-link; and clinics that use it. This article is based on Medley, Inc.'s official notices and does not cover attack methods. The affected clinics have not been named, and this site does not guess which they are.
Developing: this article will be updated as the organisation publishes more
As of October 24, 2026Not yet known
- The number and names of affected clinics
- The number of people affected
- The specific attack method (the company says it will not disclose it)
- How passwords were stored
- When the patient app and web booking will restart
- Whether secondary harm such as fake messages or unauthorized logins to other services has occurred
Medley, Inc. says it is continuing to investigate the numbers with an outside specialist organization to ensure accuracy, and will notify affected people in turn, working with the clinics. Its "latest information" page says it will post updates on the investigation and the restart as they come; when checked on October 24, it was last updated at 16:00 on October 23.
What patients should do today
Change the password on every service where you reused it
The leaked items include the app and web-booking login ID and password. The company asks anyone who used the same password on other services to change it there, because someone could log in to those services.
Start with online shopping, email and social media accounts that used the same password (including slight variations). Do not reuse the new one; a password manager makes long, unique passwords easy. Turn on two-step verification where available (how to set up multi-factor authentication).
Set a new at-link password when the service restarts
At-link app and web-booking passwords will not be carried over; users will set new ones when the service restarts. The company says there is no need to change them before then. When the restart notice arrives, choose a password you do not use anywhere else.
Do not open links, even in messages that mention your clinic or visit
The leaked items include the name of the clinic used and the last visit date. That makes it possible to write convincing fake messages, such as "This is your clinic, about your last visit," that refer to where and when you were actually seen.
The company warns about suspicious emails, text messages and calls claiming to be from the company, at-link, clinics or card companies, and says it will never ask for passwords or card details. Check with your clinic using the number on your patient card or its official website (see what phishing is).
Check your card statement (no reissue has been requested)
For people who paid online through the app, the payment dates and amounts leaked. The company says it does not hold card numbers, and it has not asked anyone to reissue cards. If someone claiming to be your card company asks for your number or a verification code, do not answer, and check your statement for charges you do not recognize.
Wait for the notice, and send questions to the dedicated contact
The company says it will notify affected people in turn, working with the clinics that use at-link. The patient contact listed on its notice page is the dedicated email address at-link@medley.jp. For new bookings or changes, contact the clinic directly.
You may be affected even if you never used the app
According to the company, people who used an affected clinic (which clinics is under investigation) but did not use the app or web booking are also affected. Their leaked items are name, furigana, birth month and day, clinic name, registration date, last visit date, and a login ID and initial password. Login details prepared before the patient ever started using the service are among the leaked items.
What clinics should do
The company has given clinics that use at-link the following guidance on operating during the suspension and on what to tell patients.
Direct patient questions to the company's dedicated contact
The company asks clinics to give patients its contact details when they ask about the incident or the app. The dedicated patient email address is at-link@medley.jp. The phone line for clinics is listed on the company's notice page.
Take new bookings and changes in house
The patient app and web-booking site are suspended. The company asks each clinic to keep handling new bookings and changes itself. It says it has sent operating manuals and a booking list file for each clinic, and asks clinics to contact it if these have not arrived.
Warn patients about fake messages at reception and by phone
The company also warns about suspicious messages claiming to be from clinics. A notice at reception saying "we will never ask for passwords or card numbers by email or text" helps patients spot fakes. This is this site's suggestion, not the company's guidance.
What happened (according to Medley, Inc.)
The following is based on the company's October 15 notice (the same page, updated through 16:00 on October 23) and its October 23 notice on the investigation. The October 15, 19 and 20 versions were checked in copies saved by the Internet Archive.
Late September to mid-October 2026
A third party accessed the company's database through a program it had planted without authorization and obtained information (confirmed in the October 23 notice).October 11
After an outside specialist organization alerted it to possible unauthorized access, the company began investigating (and later confirmed unauthorized access by a third party).Late night, October 14
To contain the damage and investigate, the company suspended at-link, the patient-facing at-link app and related services.October 15
Announcement. The company said whether data had leaked, and the scope, were under investigation, and that it had reported to the Personal Information Protection Commission and consulted the police.October 19
The company said it planned to restart clinic-side booking, patient-record and consultation-calendar features in stages from the morning of October 22 as a new service, "@link Cloud beta," built in a separate environment. It said fees for the suspension period would be refunded, with bank transfers or similar planned for some time in November.October 20
The company postponed its planned report on the investigation, saying additional items needed investigating.October 23
The company announced it had confirmed the leak of personal data and published the items. It said it had reported to the Personal Information Protection Commission and the Ministry of Health, Labour and Welfare. The clinic-side restart was delayed by defects, with no date set.
Used the app or web booking
Name, furigana, birth month and day, email address (only if registered), login ID, password, clinic name, registration date, last visit date, card payment history (date and amount only; online app payments only)
To do: change reused passwords, watch for fake messages
Did not use the app or web booking
Name, furigana, birth month and day, clinic name, registration date, last visit date, login ID, initial password
To do: watch for fake messages that mention your clinic or visit, wait for the notice
Both: the company says it does not hold card numbers
- Services affected
- The medical-institution management system @link (at-link), the patient-facing at-link app and related services
- How it was found
- An alert from an outside specialist organization on October 11
- What happened
- From late September to mid-October, a third party accessed the company's database through a program it had planted without authorization and obtained information
- Leak status
- Leak confirmed (October 23). Numbers under investigation
- Use of leaked logins
- No leak of information beyond what was announced, through unauthorized logins using these credentials, has been confirmed
- Method
- Not disclosed, because doing so could invite similar attacks
- Response
- Route closed, all related credentials invalidated, services suspended. Reported to the Personal Information Protection Commission and the Ministry of Health, Labour and Welfare. Consulted the police as of October 15
- Preventing recurrence
- Because at-link had been in operation for a long time, all features are being rebuilt before the restart, with stronger authentication and access control, a review of how passwords are stored, and stronger monitoring. Security checks across the group's services
In its October 19 version, the company explained that at-link had been offered for many years and mixed on-premises systems (installed at the clinic) with cloud systems, so checking the scope was taking longer than expected.
Separately, on October 21 the company said it had temporarily suspended some other products as a precaution against a serious vulnerability in the PHP programming language, and was restarting them once fixed. It said that as of 06:00 on October 23 no unauthorized access or data leak exploiting that vulnerability had been confirmed. That notice is not about the at-link incident.
What we know and what we don't
Status as of October 24, 2026. We will update the status column when more is published.
| Item | What the notice says | Status |
|---|---|---|
| Name, furigana, birth month and day | Both app users and non-users | Leak confirmed (company) |
| Clinic name, registration date, last visit date | Both | Leak confirmed (company) |
| App and web-booking login ID and password | Password for users; initial password for non-users | Leak confirmed (company) |
| Email address | Only app or web-booking users who registered one | Leak confirmed (company) |
| Credit card payment history | Date and amount only; only those who paid online through the app | Leak confirmed (company) |
| Credit card numbers and similar | Not held by the company | Not included (company) |
| Further leaks via unauthorized logins with the leaked credentials | Not confirmed | Not confirmed (company) |
| Birth year, address, phone number, medical details | Not in the list of leaked items | Not stated |
| How passwords were stored | Not disclosed (a review of password storage is among the prevention measures) | Not stated |
| Number and names of clinics, number of people | Investigation continuing with an outside specialist organization | Under investigation |
| Specific attack method | Withheld, as disclosure could invite similar attacks | Not stated |
| Secondary harm such as fake messages | Not mentioned in the notices | Not stated |
| Restart of the patient app and web booking | New password at restart; date not set | Under investigation |
| Fees for the suspension period | To be refunded; bank transfers or similar planned for some time in November | Refund policy (company); timing planned |
Items missing from the list are not the same as items that did not leak
Birth year, address, phone number and medical details are not in the company's list of leaked items. But the company is still investigating the numbers, and not being listed is different from being stated as not included. The items could change in a later update, so watch for the notice and for updates to the company's page.
What the leaked items can be used for
In general, the following combinations can enable the following kinds of misuse. This does not mean it has happened in this case.
- Name + clinic name + last visit date: convincing fake texts or calls posing as your clinic, such as "confirming your appointment" or "about your last visit"
- Name + email address + payment date and amount: fake emails saying "there was a problem with your payment on [date]" and asking you to re-enter card details
- Login ID + password: logins to other services where the same combination was reused (credential stuffing)
- Name + birth month and day: part of the material for posing as you to other services' identity checks (the birth year is not in the list)
Knowing the clinic's name lets a fake message include where you were treated, something only you should know. That is what sets this apart from an online shop breach. Another case where customer data leaked from a booking and customer-management system used by businesses is the 2026 EPARK Relax & Esthe PeakManager breach.
This site's view: "initial passwords" issued before first use were among the leaked items
What stands out in the notice is that login IDs and initial passwords leaked even for people who did not use the app or web booking. Login details existed in the system before the patient ever started using the service.
The cause of the at-link incident has not been disclosed, so we cannot say how it could have been prevented. How at-link handled initial passwords has not been disclosed either; the points below are general checks. Below are only points that follow from the leaked items, for businesses running patient-facing services or member sign-ups.
Force a change of the initial password at first login, and make it expire
When initial passwords are handed out at reception or on paper, those never used stay valid, and can be used as-is if they leak. Check whether you can require a change at first login and disable initial passwords that go unused for a set period.
Inventory long-running systems
The company said the investigation took time because at-link had long been in operation and mixed on-premises and cloud systems, and that it is rebuilding all features before the restart. Without a list of where patient or customer data lives and which routes can read it, confirming the scope after an incident is slow.
For how clinics can prepare for system outages, see hospitals whose care was disrupted by cyberattacks.
Sources (public record)
The facts in this article are based on the public information below (in Japanese). We have not speculated about undisclosed attack methods or which clinics are affected.
- Medley, Inc., "On the status of the investigation into unauthorized access to at-link" (October 23, 2026) — at-link.net
- Medley, Inc., "Latest information on the unauthorized access to at-link and the temporary suspension of service" (October 15, 2026; updated 16:00 October 23) — at-link.net (October 15, 19 and 20 versions checked in the Internet Archive)
- Medley, Inc., same notice on its corporate site (October 15, 2026; updated 16:00 October 23) — medley.jp
- Medley, Inc., "Notice on the restart of some products" (October 21, 2026; as of 06:00 October 23; a separate matter) — medley.jp
Update history
2026-10-24: First version. Based on Medley, Inc.'s October 15 notice (including updates through 16:00 October 23) and its October 23 notice on the investigation. Will be updated once the number of clinics and people affected and the restart date of the patient app are published.
Read next
- Similar cases: EPARK Relax & Esthe PeakManager breach / Hospitals whose care was disrupted by cyberattacks
- Passwords: Check whether your password has leaked / Choosing and using a password manager / Setting up multi-factor authentication
- Fake messages: What phishing is
- Other 2026 cases: List of data breaches and cyberattacks